NAME¶

knife-client - The man page for the knife client subcommand. When a node runs the chef-client for the first time, it generally does not yet have an API client identity, and so it cannot make authenticated requests to the server. This is where the validation client---known as the chef-validator---comes in. When the chef-client runs, it checks if it has a client key. If the client key does not exist, it then attempts to borrow the identity of the chef-validator to register itself with the server. In order to register with the server, the private key for the chef-validator needs to be copied to the host and placed in /etc/chef/validation.pem. Once the chef-client has registered itself with the server, it no longer uses the validation client for anything. It is recommended that you delete the private key for the chef-validator from the host after the host has registered or use the delete_validation recipe that can be found in the chef-client cookbook ( https://github.com/opscode-cookbooks/chef-client). The knife client subcommand is used to manage an API client list and their associated RSA public key-pairs. This allows authentication requests to be made to the server by any entity that uses the Chef Server API, such as the chef-client and Knife.

COMMON OPTIONS¶

The following options may be used with any of the arguments available to the knife client subcommand:

BULK DELETE¶

The bulk delete argument is used to delete any API client that matches a pattern defined by a regular expression. The regular expression must be within quotes and not be surrounded by forward slashes (/). Syntax This argument has the following syntax:

$ knife client bulk delete REGEX

Options This command does not have any specific options.

CREATE¶

The create argument is used to create a new API client. This process will generate an RSA key pair for the named API client. The public key will be stored on the server and the private key will be displayed on STDOUT or written to a named file.
Syntax This argument has the following syntax:

$ knife client create CLIENT_NAME (options)

Options This argument has the following options:
Examples To create a Chef Admin client with the name "exampleorg" and save its private key to a file, enter:

$ knife client create exampleorg -a -f "/etc/chef/client.pem"

When running the create argument on Enterprise Chef, be sure to omit the -a option:

$ knife client create exampleorg -f "/etc/chef/client.pem"

DELETE¶

The delete argument is used to delete a registered API client. Syntax This argument has the following syntax:

$ knife client delete CLIENT_NAME

Options This command does not have any specific options. Examples To delete a client with the name "client_foo", enter:

$ knife client delete client_foo

Type Y to confirm a deletion.

EDIT¶

The edit argument is used to edit the details of a registered API client. When this argument is run, Knife will open $EDITOR to enable editing of the admin attribute. (None of the other attributes should be changed using this argument.) When finished, Knife will update the server with those changes. Syntax This argument has the following syntax:

$ knife client edit CLIENT_NAME

Options This command does not have any specific options. Examples To edit a client with the name "exampleorg", enter:

$ knife client edit exampleorg

LIST¶

The list argument is used to view a list of registered API client. Syntax This argument has the following syntax:

$ knife client list (options)

Options This argument has the following options:
Examples To verify the API client list for the server, enter:

$ knife client list

to return something similar to:

exampleorg
i-12345678
rs-123456

To verify that an API client can authenticate to the server correctly, try getting a list of clients using -u and -k options to specify its name and private key:

$ knife client list -u ORGNAME -k .chef/ORGNAME.pem

REREGISTER¶

The reregister argument is used to regenerate an RSA key pair for an API client. The public key will be stored on the server and the private key will be displayed on STDOUT or written to a named file.

Note

Running this argument will invalidate the previous RSA key pair, making it unusable during authentication to the server.

Syntax This argument has the following syntax:

$ knife client reregister CLIENT_NAME (options)

Options This argument has the following options:
Examples To regenerate the RSA key pair for a client named "testclient" and save it to a file named "rsa_key", enter:

$ knife client regenerate testclient -f rsa_key

SHOW¶

The show argument is used to show the details of an API client. Syntax This argument has the following syntax:

$ knife client show CLIENT_NAME (options)

Options This argument has the following options:
Examples To view a client named "testclient", enter:

$ knife client show testclient

to return something like:

admin:       false
chef_type:   client
json_class:  Chef::ApiClient
name:        testclient
public_key:

To view information in JSON format, use the -F common option as part of the command like this:

$ knife role show devops -F json

Other formats available include text, yaml, and pp.

AUTHOR¶

Chef